RedactMy.pics

Redact a Credit Card Number From a Screenshot

Card details are the most actively traded personal data there is, and a payment screenshot usually contains four pieces of them rather than one. Covering the sixteen digits and leaving the expiry visible is a common and expensive mistake.

Open the redaction tool

Free, no account, and the image never leaves your browser.

A card number is only part of the credential

A sixteen-digit number by itself is close to useless for a fraud attempt. What makes a payment card usable is the combination: the number, the expiry date, and the security code. Add the cardholder name and billing address and you have everything a merchant needs to accept a card-not-present transaction.

This matters because screenshots rarely show one field in isolation. A checkout confirmation shows the last four digits and the expiry. A receipt shows the last four plus the cardholder name. A photo of the physical card shows all of it. A support conversation about a declined payment often includes a screenshot of the payment form, which can contain the full number in an input field.

There is also a timing problem. Card numbers are short-lived credentials — they expire, and a compromised card can be cancelled. That makes the damage bounded, which is why people treat them casually. But the window between exposure and cancellation is exactly when the fraud happens, and a number posted publicly is scraped within hours, not days.

Every field that has to go

Cover all four of the first group, or the redaction does not accomplish anything. The second group is what usually gets missed.

The full card number
Thirteen to nineteen digits, often grouped in fours with spaces or dashes. Cover all of it, including the groups at the ends — a leaked first six digits reveals the issuer and card type.
Expiry date
Usually written MM/YY near the number. It is one of the three fields required for a card-not-present charge, so it is not optional.
Security code (CVV / CVC)
Three or four digits on the signature strip or the back of the card. If it appears in the screenshot, it has to be covered.
Cardholder name
Printed on the card and usually repeated on the receipt. Combined with the number, it is what makes the transaction look legitimate.
Billing address and postcode
Frequently used as an additional verification step. It shows up in confirmation emails and invoices more often than people expect.
Last four digits in the confirmation line
Payment confirmations repeat the last four digits in a summary or header line, separate from the main detail block. Cover both copies.
Transaction and authorization IDs
Not a card credential, but enough for a support agent impersonation attempt. Usually worth covering on a public post.

How the detection handles card numbers

Card numbers have a built-in check: the Luhn checksum. The tool uses it, which means it reports far fewer false positives than a plain digit-count rule — but also that a mistyped or partially obscured number will not be found.

Found automatically

  • 13 to 19 digit numbers that pass the Luhn checksum
  • Numbers written with single spaces or dashes between groups
  • Several card numbers on the same page

Needs a box by hand

  • Numbers that fail the Luhn check because a digit is obscured, mistyped, or cut off by the edge of the screenshot.
  • Numbers where the grouping is broken by other characters, such as a slash or a label inserted mid-string.
  • Expiry dates and CVVs. These are not matched as separate patterns at all, so they always need a box drawn by hand.
  • Cardholder names and billing addresses, which are not detected in this version.
  • A physical card photographed at an angle, where the embossed digits produce uneven contrast.

The order that avoids a second pass

Cover the credentials first, then the context. Doing it the other way around makes it easy to lose track of which box covers what.

  1. Open the screenshot

    Drop it, paste it, or pick a file. PNG, JPEG, and WebP up to 25 MB and 40 million pixels.

  2. Box the number first

    Draw one box across the whole digit group rather than one box per group of four. A single wider box is harder to misalign and easier to verify at a glance.

  3. Then expiry, then security code

    These are two or four characters each, so the boxes will be small. Use solid black and give each box a few pixels of margin, because a single visible digit of a CVV narrows the search space enormously.

  4. Then the name and any repeated last-four

    Scan the header, the footer, and the summary line. Payment UIs like to restate the card in a compact form at the top of the page.

  5. Check for reflections and second screens

    On a photo of a physical card, look for the number reflected in a glossy surface or visible on a second screen in the background. This is a real cause of leaks and it is invisible unless you look for it.

  6. Download and inspect at 100%

    Open the exported PNG and zoom to actual size on each region. Thumbnails hide exactly the kind of one-pixel leak that matters here.

Why pixelation is the wrong default for digits

Pixelation works by averaging blocks of pixels into single color values. When the block size is large relative to the characters, the characters become unrecognizable. When the block size is small relative to the characters — which is what happens with small text in a screenshot — each digit may occupy its own block or two, and the block colors still encode the shape of the glyph.

Digits are the worst case for this, because there are only ten of them and they differ by a small number of strokes. A human or a script that knows the field is a card number and knows the Luhn checksum can prune candidates aggressively. That is the difference between a blur that is merely weak and a redaction that is adequate.

Solid fill does not have this failure mode. It does not degrade the glyph; it removes the pixels. There is no residual structure to reason about, because the region in the exported file contains one color.

One more point that matters for cards specifically: the tool's auto-detect uses the Luhn checksum to decide whether a digit run is a card number. That is a good filter for false positives, but it has a subtle consequence worth knowing. A number that has been partially covered by the screenshot crop, or that contains an OCR error, will not pass the checksum and will not be reported. Detection agreeing with you is not evidence that the number is gone; it is only evidence that a well-formed number was found.

Frequently asked questions

Is covering the middle digits enough?
No. The first six digits identify the issuer and card product, and the last four are used for verification. If an attacker has both ends plus the expiry, the remaining search space is small enough to be a real problem.
Why did auto-detect not find my card number?
Most likely the digits fail the Luhn checksum — because of an OCR misread, a partially obscured digit, or a number that is not a valid card number at all, such as an order reference. Draw the box by hand in that case.
Does the tool store the card number anywhere?
No. There is no server component and no storage. The recognition runs in your browser, the boxes live in memory, and reloading the page discards everything.
Can I redact several areas at once?
Yes, draw as many boxes as you need. Each box can be edited separately: you can toggle it off, change its fill style, or delete it from the panel that opens when you click it.
What file format should I share afterwards?
The tool exports PNG. Re-encoding from a canvas means the file is rebuilt rather than edited in place, and metadata from the source file is not carried across.